Apply filters to table data to isolate or exclude specified field values. The results are returned immediately and displayed in chronological order and at the same time, the timeline is updated to match the query.
- Select the icon in the query window toolbar. The Operations Over Columns window appears with the Filter data option selected.
- Choose the required filter type in the Operation drop-down list.
- Select the arguments of the filter. Depending on the filter type selected, you will be prompted to select a set of specific arguments.
You can select columns or also enter free text clicking the icon, as is sometimes required for an operation. For example, you might filter for URLs that contain the string bing. Then choose normal to include the filtered events, or select negated to exclude the filtered events.
- Click Filter data when you're done. The data table will only show those events that meet the conditions of the filter applied.
Case sensitivity selector
Some operations have a case sensitive and a case insensitive version, for example, Contains - case insensitive (weakhas) and Contains (has, ->). Use the Case sensitivity buttons in the window to display only the sensitive or insensitive versions of these operations, or choose all to show both versions. Operations that don't have a sensitive and insensitive version will be visible no matter the option selected.
Alternatively, you can create a filter in one of the following ways:
If you select a cell from the data table and press ENTER, the Operations over columns window will be open in the Filter data tab, and the Equal (eq, =) operation selected. The cell selected and the column it belongs to will be automatically added as arguments of the filter.
Select the arrow icon that appears when hovering over a column header to see the list of distinct values in that column, then click a value name. The Operations over columns window will be open in the Filter data tab, and the Equal (eq, =) operation selected. The column and value selected will be automatically added as arguments of the filter.
The following articles define all the expressions and functions available for filtering the data.
Filter column data using the OR selector
You can also filter the data using the OR selector. In this way, you can include specific values from one or several columns to define a filter that displays events that meet x OR y conditions.
- Select the icon in the query window toolbar and the Operations Over Columns window appears with the OR option selected.
- Hover over a column header and a down-arrow icon appears. Select it to open the top 10 column menu. Select the check box of any value from this list. Now select at least one more value from the list to add it to the Or filter. You can also select column values from other columns.
- Select the operators that define the filter you wish to create and select Apply. In this example, we wanted to look at the session events that had a status code of either OK (200) or Bad request (400).
You can also apply an OR filter directly in the top 10 values list. The Operations Over Columns window will appear once you select the first value.